A team of three can check laptops by hand. Somewhere around ten devices, or when a customer asks for proof, manual checks stop working and device management pays for itself. Adopt it when you cannot say, within an hour, which laptops are encrypted, patched and locked. Start with a few settings, not a long policy.
What device management does
A device management tool lets you set and check settings centrally: disk encryption, screen lock, operating system updates, firewall, and remote lock or wipe. It also gives you an inventory of devices with owners and serial numbers.
It does not make a laptop secure on its own. It makes the baseline visible and enforceable.
Signals that it is time
- You cannot list every device and its owner.
- A laptop went missing and you did not know whether it was encrypted.
- A customer questionnaire asks about endpoint controls and you answer from memory.
- You have contractors using their own machines.
- Updates depend on people remembering.
- You are pursuing an audit that will ask for device evidence.
The minimum settings
- Full disk encryption on, with recovery keys escrowed to a place the company controls.
- Screen lock after a short idle time with a password or biometrics.
- Automatic operating system and browser updates.
- Firewall on.
- Remote lock and wipe available.
- Device inventory with owner.
Microsoft's documentation states that BitLocker addresses data exposure from lost, stolen or decommissioned devices, and Apple's FileVault guide stresses keeping recovery keys away from the Mac. Escrowing them centrally is one thing a management tool does well.
Personal devices
Many startups let people use their own laptops. You can allow it with limits: require encryption and a screen lock, separate work data into managed apps or a browser profile, and remove work access at departure. Be clear about what you can see and wipe, and respect personal data.
Costs and trade offs
A tool adds licences, enrollment effort and some user friction. Choose one that supports the operating systems you use, and pilot with a few people first. Avoid features you will never turn on.
Do not forget phones
If staff read company email or approve logins on phones, include them. Require a passcode and allow remote removal of work accounts.
Evidence.
Export a report of encryption and update status each quarter and keep it. This is the artifact customers and auditors accept.
Common pitfalls.
Common mistakes: buying a tool and enrolling only some devices, which leaves you unable to claim coverage; skipping recovery key escrow and then discovering a locked laptop cannot be recovered; and enforcing settings without telling people, which creates surprise lockouts. Announce what will be enforced and why, give a date, and offer help. Keep an exceptions list with an owner and a review date, since every team has a few special cases.
Quick check
Is MDM the same as EDR?
No. Device management configures and inventories devices. Endpoint detection looks for attacks on them. They solve different problems.
Sources
Last reviewed: 19 October 2026.
